Duo Tech
@duotechTrusted contributor
2 followers12,749 downloads5,503 copies88 likes23,030 views
2,481 detections
Filters
Last updated
All Time
Detection languages
852
614
584
276
133
Categories
808
390
193
186
173
Platforms
1,558
359
295
250
89
Products / Services
478
177
169
165
158
MITRE Techniques
674
615
364
249
221
CVEs
64
62
21
20
15
IDS Classtypes
124
78
23
13
11
IDS Protocols
133
46
39
29
6
Detects the execution of ScreenConnect.ClientService.exe with command line arguments containing 'servermanagemen' or 'Microsoft Update Service'. This pattern is often associated with the use of ConnectWise (ScreenConnect) remote access software, which can be leveraged for legitimate administration or malicious remote control.
Detects network activity (DNS queries, TLS SNI, and HTTP requests) directed towards known attacker-controlled command-and-control domains associated with AsyncRAT and ScreenConnect abuse.
This rule detects scenarios where common web browsers (Firefox, Chrome, Edge, IE) launch Windows scripting hosts (wscript.exe or cscript.exe) to execute .vbs files. This behavior is highly characteristic of drive-by download attacks or malicious browser-based content attempting to execute local scripts for further exploitation.
Detects the creation of power management assertions using the IOPMAssertionCreateWithName API by processes other than standard system binaries. Attackers may use this technique to prevent a system from sleeping, which can be leveraged to maintain persistence or ensure that malicious background activities continue without interruption.
Detects the creation or execution of executable files from within %APPDATA%\Local\Temp subdirectories starting with '100000', a path pattern frequently associated with the distribution and staging of infostealer malware such as RedLine and Lumma.
Detects PE files exhibiting behavior consistent with LokiBot malware, specifically the use of a custom CRC32-variant hash function with a XOR polynomial of 0x4358AD54 for runtime API resolution. This technique is used to evade static import analysis by resolving Windows APIs dynamically via hashed identifiers.
Detects the Bumblebee loader by identifying a hardcoded list of CIS-region locale strings within the file, used in conjunction with 'GetSystemDefaultLocaleName' and 'ExitProcess' to perform an anti-analysis kill switch, terminating execution if the infected system is located in a Commonwealth of Independent States (CIS) region.
This rule monitors network traffic for HTTP requests or DNS queries targeting 'nacos', a popular service discovery and configuration management platform. The rule specifically flags potential interaction attempts and identifies whether the activity includes login-related path patterns, which could indicate unauthorized access attempts or reconnaissance against a Nacos instance.
Detects instances where the 'pg_dump' database utility is executed, followed by the deletion of a file within a one-hour window by the same agent. This behavior is indicative of an attacker extracting sensitive database contents and subsequently attempting to remove evidence of the dump or staging files.
Detects high-frequency execution of MySQL enumeration queries (such as showing databases, tables, or selecting from the information_schema) by the MySQL client process. This behavior is often associated with database reconnaissance or automated scanning during the discovery phase of an attack.
Page 210 of 249